Describe your package here Describe your package requirements here Currently there are no FAQ items provided. pfblockernglistsv4 1.0 /usr/local/pkg/pfblockerng/pfblockerng.inc pfBlockerNG: Save IPv4 settings pfBlockerNG

Firewall

pfblockerng_v4lists.xml General /pkg_edit.php?xml=pfblockerng.xml Update /pfblockerng/pfblockerng_update.php Alerts /pfblockerng/pfblockerng_alerts.php Reputation /pkg_edit.php?xml=/pfblockerng/pfblockerng_reputation.xml IPv4 /pkg.php?xml=/pfblockerng/pfblockerng_v4lists.xml IPv6 /pkg.php?xml=/pfblockerng/pfblockerng_v6lists.xml DNSBL /pkg_edit.php?xml=/pfblockerng/pfblockerng_dnsbl.xml Country /pkg_edit.php?xml=/pfblockerng/pfblockerng_top20.xml Logs /pfblockerng/pfblockerng_log.php Sync /pkg_edit.php?xml=/pfblockerng/pfblockerng_sync.xml Alias Name aliasname Alias Description description Action action Frequency cron Logging aliaslog Add a new Alias on listtopic LINKS Firewall Alias  Firewall Rules Firewall Logs]]> info Alias Name aliasname Do not include 'pfBlocker' or 'pfB_' in the Alias Name, it's done by package.
International, special or space characters will be ignored in firewall alias names.
]]> input 20 List Description description input 90 info 'Format': Select the Format type.

'State': Select the run state.

'Source':

• 'URL': External link to source  (ie: ET Compromised, ET Blocked, Spamhaus Drop)

• 'Local File': http(s)://127.0.0.1/filename  or  /var/db/pfblockerng/filename

• 'Country code': /usr/pbi/pfblockerng-amd64/share/GeoIP/cc/US_v4.txt  (Change 'US' to required code)

• 'Whois': Domain name or AS (ie: facebook.com or AS13414)  (Click for ASN Lookup)

'Header/Label': This field must be unique. This names the file and is referenced in the widget.  (ie: Spamhaus_drop, Spamhaus_edrop)

]]> IPv4 Lists]]> 'Format': Select the file format that URL will retrieve.

• 'auto' - Default parser
• 'regex' - 'Regex' style parsing (ie: html Lists)
• 'whois' - Convert a Domain name or AS into its respective IP addresses.
• 'rsync' - RSync Lists

'State': Select the Run State for each list

• 'ON/OFF' - Enabled / Disabled
• 'HOLD' - Once a List has been Downloaded, list will remain Static
• 'FLEX' - Not Recommended - Allow downgraded SSL connections

'Note': Source lists musts follow the syntax below:

Network ranges: 172.16.1.0-172.16.1.255
IP Address: 172.16.1.10
CIDR: 172.16.1.0/24

]]> rowhelper Format format select Autoauto Regexregex Whoiswhois RSyncrsync auto State state select ONEnabled OFFDisabled HOLDHold FLEXFlex Enabled Source url input 50 Header/Label header input 15 List Action Default: Disabled

Select the Action for Firewall Rules on lists you have selected.

'Disabled' Rules: Disables selection and does nothing to selected Alias.

'Deny' Rules:
'Deny' rules create high priority 'block' or 'reject' rules on the stated interfaces. They don't change the 'pass' rules on other interfaces. Typical uses of 'Deny' rules are:

• Deny Both - blocks all traffic in both directions, if the source or destination IP is in the block list
• Deny Inbound/Deny Outbound - blocks all traffic in one direction unless it is part of a session started by traffic sent in the other direction. Does not affect traffic in the other direction.
• One way 'Deny' rules can be used to selectively block unsolicited incoming (new session) packets in one direction, while still allowing deliberate outgoing sessions to be created in the other direction.

'Permit' Rules:
'Permit' rules create high priority 'pass' rules on the stated interfaces. They are the opposite of Deny rules, and don't create any 'blocking' effect anywhere. They have priority over all Deny rules. Typical uses of 'Permit' rules are:

• To ensure that traffic to/from the listed IPs will always be allowed in the stated directions. They override almost all other Firewall rules on the stated interfaces.
• To act as a whitelist for Deny rule exceptions, for example if a large IP range or pre-created blocklist blocks a few IPs that should be accessible.

'Match' Rules:
'Match' or 'Log' only the traffic on the stated interfaces. This does not Block or Reject. It just Logs the traffic.

• Match Both - Matches all traffic in both directions, if the source or destination IP is in the list.
• Match Inbound/Match Outbound - Matches all traffic in one direction only.

'Alias' Rules:
'Alias' rules create an alias for the list (and do nothing else). This enables a pfBlockerNG list to be used by name, in any firewall rule or pfSense function, as desired.

• Options - Alias Deny,  Alias Permit,  Alias Match,  Alias Native


• 'Alias Deny' can use De-Duplication and Reputation Processes if configured.


• 'Alias Permit' and 'Alias Match' will be saved in the Same folder as the other Permit/Match Auto-Rules


• 'Alias Native' lists are kept in their Native format without any modifications.

Note:

When manually creating 'Alias' type firewall rules; Do not add (pfB_) to the start of the rule description, use (pfb_) (Lowercase prefix). Manually created 'Alias' rules with 'pfB_' in the description will be auto-removed by package when 'Auto' rules are defined.

]]> action select DisabledDisabled Deny InboundDeny_Inbound Deny OutboundDeny_Outbound Deny BothDeny_Both Permit InboundPermit_Inbound Permit OutboundPermit_Outbound Permit BothPermit_Both Match InboundMatch_Inbound Match OutboundMatch_Outbound Match BothMatch_Both Alias DenyAlias_Deny Alias PermitAlias_Permit Alias MatchAlias_Match Alias NativeAlias_Native Update Frequency cron Never
Select how often List files will be downloaded. This must be within the Cron Interval/Start Hour settings.]]> select NeverNever Every Hour01hour Every 2 Hours02hours Every 3 Hours03hours Every 4 Hours04hours Every 6 Hours06hours Every 8 Hours08hours Every 12 Hours12hours Once a dayEveryDay WeeklyWeekly Weekly (Day of Week) dow Monday
Select the 'Weekly' ( Day of the Week ) to Update
This is only required for the 'Weekly' Frequency Selection. The 24 Hour Download 'Time' will be used.]]> select Monday1 Tuesday2 Wednesday3 Thursday4 Friday5 Saturday6 Sunday7 Enable Logging aliaslog Enable
Select - Logging to Status: System Logs: FIREWALL ( Log )
This can be overriden by the 'Global Logging' Option in the General Tab.]]> select Enableenabled Disabledisabled stateremoval States Removal With the 'Kill States' option (General Tab), you can disable States removal for this Alias. select Enableenabled Disabledisabled enabled Advanced Inbound Firewall Rule Settings listtopic info Note:  In general, Auto-Rules are created as follows:

Inbound  - 'any' port, 'any' protocol and 'any' destination
Outbound - 'any' port, 'any' protocol and 'any' destination address in the lists

Configuring the Adv. Inbound Rule settings, will allow for more customization of the Inbound Auto-Rules.
Select the pfSense 'Port' and/or 'Destination' Alias below:]]> autoports Enable Custom Port checkbox aliasports begin Define Alias aliasports Click Here to add/edit Aliases Do not manually enter port numbers.
Do not use 'pfB_' in the Port Alias name.]]> 21 aliases port end autodest Enable Custom Destination checkbox aliasdest,autonot begin aliasdest Click Here to add/edit Aliases Do not manually enter Addresses(es).
Do not use 'pfB_' in the 'IP Network Type' Alias name.]]> 21 aliases network Invert autonot Invert - Option to invert the sense of the match.
ie - Not (!) Destination Address(es)]]> checkbox end Custom Protocol autoproto Default: any
Select the Protocol used for Inbound Firewall Rule(s).
Do not use 'any' with Adv. Inbound Rules as it will bypass these settings!]]> select any TCPtcp UDPudp TCP/UDPtcp/udp 4 IPv4 Custom list listtopic info Note:  Custom List can be used in ONE of two ways:

1. IPv4 addresses entered directly into the custom list, as per the required format.
2. Domain names or AS numbers, which will be converted into their respective IPv4 addresses.

]]> whois_convert DO NOT mix IPs with Domains/ASs in this custom list.]]> Enable Domain/AS checkbox Custom Address(es) custom
Format IPv4:

Network ranges: 172.16.1.0-172.16.1.255
IP Address: 172.16.1.10
CIDR: 172.16.1.0/24

RFC 1918 addresses may be used in a custom list.
You may use "#" after any IP/CIDR/Range to add comments. ie: x.x.x.x # Safe IP Address

If you select the Domain/AS checkbox above, the custom list can only be used for Domain names/AS's.

Format Domain/AS:

One 'Domain' or 'AS' per line.
Domains and/or ASs can be used in the same list.

Conversion of Domains/ASs utilize Team CYMRU and the RADb whois registry.
Configure the 'update frequency', so that it does not abuse these free services.]]> textarea 50 10 base64 Update Custom List custom_update Default' to update Custom List as per Update Frequency setting.
Select - 'Update Custom List' followed by a 'Force Update' to apply Custom List Changes.
Cron will also resync this Custom List at the next Update Frequency.]]> select Defaultdisabled Update Custom Listenabled Click to SAVE Settings and/or Rule Edits.   Changes are Applied via CRON or 'Force Update']]> listtopic